Partially addresses #47424.

Additionally we're delegating missing method calls on GpgKeySubkey to
GpgKey since most of the info required when verifying a signature is
found on GpgKey which is the parent of GpgKeySubkey

This reverts commit cce9afa38a8aa3f3e5a43ab952e1c022c9dd9385.

this is used to make a difference between a committer email that belongs
to user, where the user used a different email for the gpg key. this
means that the user is the same, but a different, unverified email is
used for the signature.

the updated verification of a gpg signature requires the committer's
email to also match the user's and the key's emails.

we need the commit object for the updated verification that also checks
the committer's email to match the gpg key and user's emails.

we need to store the keyid to be able to update the signature later in
case the missing key is added later.